The remote OracleVM system is missing necessary patches to address critical security updates :

  - x86/traps: loop in the correct direction in compat_iret     This is XSA-136. (CVE-2015-4164)

  - pcnet: force the buffer access to be in bounds during tx     4096 is the maximum length per TMD and it is also     currently the size of the relay buffer pcnet driver uses     for sending the packet data to QEMU for further     processing. With packet spanning multiple TMDs it can     happen that the overall packet size will be bigger than     sizeof(buffer), which results in memory corruption. Fix     this by only allowing to queue maximum sizeof(buffer)     bytes. This is CVE-2015-3209. (CVE-2015-3209)

  - pcnet: fix Negative array index read From: Gonglei     s->xmit_pos maybe assigned to a negative value (-1), but     in this branch variable s->xmit_pos as an index to array     s->buffer. Let's add a check for s->xmit_pos.
    upstream-commit-id:
    7b50d00911ddd6d56a766ac5671e47304c20a21b (CVE-2015-3209)

  - pcnet: force the buffer access to be in bounds during tx     4096 is the maximum length per TMD and it is also     currently the size of the relay buffer pcnet driver uses     for sending the packet data to QEMU for further     processing. With packet spanning multiple TMDs it can     happen that the overall packet size will be bigger than     sizeof(buffer), which results in memory corruption. Fix     this by only allowing to queue maximum sizeof(buffer)     bytes. This is CVE-2015-3209. (CVE-2015-3209)

  - pcnet: fix Negative array index read From: Gonglei     s->xmit_pos maybe assigned to a negative value (-1), but     in this branch variable s->xmit_pos as an index to array     s->buffer. Let's add a check for s->xmit_pos.
    upstream-commit-id:
    7b50d00911ddd6d56a766ac5671e47304c20a21b (CVE-2015-3209)

  - gnttab: add missing version check to     GNTTABOP_swap_grant_ref handling ... avoiding NULL     derefs when the version to use wasn't set yet (via     GNTTABOP_setup_table or GNTTABOP_set_version). This is     XSA-134. (CVE-2015-4163)

The remote OracleVM system is missing necessary patches to address critical security updates :

  - fix CVE-2015-4000 - prevent the logjam attack on client
    - restrict the DH key size to at least 768 bits (limit     will be increased in future)

  - drop the AES-GCM restriction of 2^32 operations because     the IV is always 96 bits (32 bit fixed field + 64 bit     invocation field)

The remote OracleVM system is missing necessary patches to address critical security updates : please see Oracle VM Security Advisory OVMSA-2015-0064 for details.

The remote OracleVM system is missing necessary patches to address critical security updates :

  - xen/pt: unknown PCI config space fields should be     read-only ... by default. Add a per-device 'permissive'     mode similar to pciback's to allow restoring previous     behavior (and hence break security again, i.e. should be     used only for trusted guests). This is part of XSA-131.
    (CVE-2015-4106)

  - xen/pt: add a few PCI config space field descriptions     Since the next patch will turn all not explicitly     described fields read-only by default, those fields that     have guest writable bits need to be given explicit     descriptors. This is a preparatory patch for XSA-131.
    (CVE-2015-4106)

  - xen/pt: mark reserved bits in PCI config space fields     The adjustments are solely to make the subsequent     patches work right (and hence make the patch set     consistent), namely if permissive mode (introduced by     the last patch) gets used (as both reserved registers     and reserved fields must be similarly protected from     guest access in default mode, but the guest should be     allowed access to them in permissive mode). This is a     preparatory patch for XSA-131. (CVE-2015-4106)

  - xen/pt: mark all PCIe capability bits read-only     xen_pt_emu_reg_pcie[]'s PCI_EXP_DEVCAP needs to cover     all bits as read- only to avoid unintended write-back     (just a precaution, the field ought to be read-only in     hardware). This is a preparatory patch for XSA-131.
    (CVE-2015-4106)

  - xen/pt: split out calculation of throughable mask in PCI     config space handling This is just to avoid having to     adjust that calculation later in multiple places. Note     that including ->ro_mask in get_throughable_mask's     calculation is only an apparent (i.e. benign) behavioral     change: For r/o fields it doesn't matter > whether they     get passed through - either the same flag is also set in     emu_mask (then there's no change at all) or the field is     r/o in hardware (and hence a write won't change it     anyway). This is a preparatory patch for XSA-131.
    (CVE-2015-4106)

  - xen/pt: correctly handle PM status bit     xen_pt_pmcsr_reg_write needs an adjustment to deal with     the RW1C nature of the not passed through bit 15     (PCI_PM_CTRL_PME_STATUS). This is a preparatory patch     for XSA-131. (CVE-2015-4106)

  - xen/pt: consolidate PM capability emu_mask There's no     point in xen_pt_pmcsr_reg_[read,write] each ORing     PCI_PM_CTRL_STATE_MASK and PCI_PM_CTRL_NO_SOFT_RESET     into a local emu_mask variable - we can have the same     effect by setting the field descriptor's emu_mask member     suitably right away. Note that xen_pt_pmcsr_reg_write is     being retained in order to allow later patches to be     less intrusive. This is a preparatory patch for XSA-131.
    (CVE-2015-4106)

  - xen/MSI: don't open-code pass-through of enable bit     modifications Without this the actual XSA-131 fix would     cause the enable bit to not get set anymore (due to the     write back getting suppressed there based on the OR of     emu_mask, ro_mask, and res_mask). Note that the fiddling     with the enable bit shouldn't really be done by qemu,     but making this work right (via libxc and the     hypervisor) will require more extensive changes, which     can be postponed until after the security issue got     addressed. This is a preparatory patch for XSA-131.
    (CVE-2015-4106)

  - xen/MSI-X: disable logging by default ... to avoid     allowing the guest to cause the control domain's disk to     fill. This is XSA-130. (CVE-2015-4105)

  - xen: don't allow guest to control MSI mask register It's     being used by the hypervisor. For now simply mimic a     device not capable of masking, and fully emulate any     accesses a guest may issue nevertheless as simple     reads/writes without side effects. This is XSA-129.
    (CVE-2015-4104)

  - xen: properly gate host writes of modified PCI CFG     contents The old logic didn't work as intended when an     access spanned multiple fields (for example a 32-bit     access to the location of the MSI Message Data field     with the high 16 bits not being covered by any known     field). Remove it and derive which fields not to write     to from the accessed fields' emulation masks: When     they're all ones, there's no point in doing any host     write. This fixes a secondary issue at once: We     obviously shouldn't make any host write attempt when     already the host read failed. This is XSA-128.

    Conflicts: tools/ioemu-remote/hw/pass-through.c     (CVE-2015-4103)

The remote OracleVM system is missing necessary patches to address critical security updates :

  - crypto: aesni

  - fix memory usage in GCM decryption (Stephan Mueller)     [Orabug: 21077385] (CVE-2015-3331)

  - xen/pciback: Don't disable PCI_COMMAND on PCI device     reset. (Konrad Rzeszutek Wilk) [Orabug: 20807438]     (CVE-2015-2150)

  - xen-blkfront: fix accounting of reqs when migrating     (Roger Pau Monne) [Orabug: 20860817]

  - Doc/cpu-hotplug: Specify race-free way to register CPU     hotplug callbacks (Srivatsa S. Bhat) [Orabug: 20917697]

  - net/iucv/iucv.c: Fix CPU hotplug callback registration     (Srivatsa S. Bhat) [Orabug: 20917697]

  - net/core/flow.c: Fix CPU hotplug callback registration     (Srivatsa S. Bhat) [Orabug: 20917697]

  - mm, vmstat: Fix CPU hotplug callback registration     (Srivatsa S. Bhat) [Orabug: 20917697] 

  - profile: Fix CPU hotplug callback registration (Srivatsa     S. Bhat) 

  - trace, ring-buffer: Fix CPU hotplug callback     registration (Srivatsa S. Bhat) [Orabug: 20917697]

  - hwmon, via-cputemp: Fix CPU hotplug callback     registration (Srivatsa S. Bhat) 

  - hwmon, coretemp: Fix CPU hotplug callback registration     (Srivatsa S. Bhat) [Orabug: 20917697]

  - octeon, watchdog: Fix CPU hotplug callback registration     (Srivatsa S. Bhat) [Orabug: 20917697]

  - oprofile, nmi-timer: Fix CPU hotplug callback     registration (Srivatsa S. Bhat) [Orabug: 20917697]

  - intel-idle: Fix CPU hotplug callback registration     (Srivatsa S. Bhat) [Orabug: 20917697]

  - drivers/base/topology.c: Fix CPU hotplug callback     registration (Srivatsa S. Bhat) [Orabug: 20917697]

  - acpi-cpufreq: Fix CPU hotplug callback registration     (Srivatsa S. Bhat) [Orabug: 20917697]

  - scsi, fcoe: Fix CPU hotplug callback registration     (Srivatsa S. Bhat) [Orabug: 20917697] 

  - scsi, bnx2fc: Fix CPU hotplug callback registration     (Srivatsa S. Bhat) [Orabug: 20917697]

  - scsi, bnx2i: Fix CPU hotplug callback registration     (Srivatsa S. Bhat) [Orabug: 20917697]

  - arm64, debug-monitors: Fix CPU hotplug callback     registration (Srivatsa S. Bhat) [Orabug: 20917697]

  - arm64, hw_breakpoint.c: Fix CPU hotplug callback     registration (Srivatsa S. Bhat) [Orabug: 20917697]

  - x86, kvm: Fix CPU hotplug callback registration     (Srivatsa S. Bhat) [Orabug: 20917697]

  - x86, oprofile, nmi: Fix CPU hotplug callback     registration (Srivatsa S. Bhat) [Orabug: 20917697]

  - x86, pci, amd-bus: Fix CPU hotplug callback registration     (Srivatsa S. Bhat) [Orabug: 20917697]

  - x86, hpet: Fix CPU hotplug callback registration     (Srivatsa S. Bhat) [Orabug: 20917697]

  - x86, intel, cacheinfo: Fix CPU hotplug callback     registration (Srivatsa S. Bhat) [Orabug: 20917697]

  - x86, amd, ibs: Fix CPU hotplug callback registration     (Srivatsa S. Bhat) [Orabug: 20917697]

  - x86, therm_throt.c: Fix CPU hotplug callback     registration (Srivatsa S. Bhat) [Orabug: 20917697]

  - x86, mce: Fix CPU hotplug callback registration     (Srivatsa S. Bhat) [Orabug: 20917697]

  - x86, intel, uncore: Fix CPU hotplug callback     registration (Srivatsa S. Bhat) [Orabug: 20917697]

  - x86, vsyscall: Fix CPU hotplug callback registration     (Srivatsa S. Bhat) [Orabug: 20917697]

  - x86, cpuid: Fix CPU hotplug callback registration     (Srivatsa S. Bhat) [Orabug: 20917697]

  - x86, msr: Fix CPU hotplug callback registration     (Srivatsa S. Bhat) [Orabug: 20917697]

  - powerpc, sysfs: Fix CPU hotplug callback registration     (Srivatsa S. Bhat) 

  - sparc, sysfs: Fix CPU hotplug callback registration     (Srivatsa S. Bhat) [Orabug: 20917697]

  - s390, smp: Fix CPU hotplug callback registration     (Srivatsa S. Bhat) [Orabug: 20917697]

  - s390, cacheinfo: Fix CPU hotplug callback registration     (Srivatsa S. Bhat) 

  - arm, hw-breakpoint: Fix CPU hotplug callback     registration (Srivatsa S. Bhat) [Orabug: 20917697]

  - ia64, err-inject: Fix CPU hotplug callback registration     (Srivatsa S. Bhat) [Orabug: 20917697]

  - ia64, topology: Fix CPU hotplug callback registration     (Srivatsa S. Bhat) [Orabug: 20917697]

  - ia64, palinfo: Fix CPU hotplug callback registration     (Srivatsa S. Bhat) [Orabug: 20917697]

  - CPU hotplug, perf: Fix CPU hotplug callback registration     (Srivatsa S. Bhat) [Orabug: 20917697]

  - CPU hotplug: Provide lockless versions of callback     registration functions (Srivatsa S. Bhat) [Orabug:
    20917697]

  - isofs: Fix unchecked printing of ER records (Jan Kara)     [Orabug: 20930551] (CVE-2014-9584)

  - KEYS: close race between key lookup and freeing (Sasha     Levin) [Orabug: 20930548] (CVE-2014-9529)     (CVE-2014-9529)

  - mm: memcg: do not allow task about to OOM kill to bypass     the limit (Johannes Weiner) [Orabug: 20930539]     (CVE-2014-8171)

  - mm: memcg: do not declare OOM from __GFP_NOFAIL     allocations (Johannes Weiner) [Orabug: 20930539]     (CVE-2014-8171)

  - fs: buffer: move allocation failure loop into the     allocator (Johannes Weiner) [Orabug: 20930539]     (CVE-2014-8171)

  - mm: memcg: handle non-error OOM situations more     gracefully (Johannes Weiner) [Orabug: 20930539]     (CVE-2014-8171)

  - mm: memcg: do not trap chargers with full callstack on     OOM (Johannes Weiner) [Orabug: 20930539] (CVE-2014-8171)

  - mm: memcg: rework and document OOM waiting and wakeup     (Johannes Weiner) [Orabug: 20930539] (CVE-2014-8171)

  - mm: memcg: enable memcg OOM killer only for user faults     (Johannes Weiner) [Orabug: 20930539] (CVE-2014-8171)

  - x86: finish user fault error path with fatal signal     (Johannes Weiner) [Orabug: 20930539] (CVE-2014-8171)

  - arch: mm: pass userspace fault flag to generic fault     handler (Johannes Weiner) [Orabug: 20930539]     (CVE-2014-8171)

  - selinux: Permit bounded transitions under NO_NEW_PRIVS     or NOSUID. (Stephen Smalley) [Orabug: 20930501]     (CVE-2014-3215)

  - IB/core: Prevent integer overflow in ib_umem_get address     arithmetic (Shachar Raindel) [Orabug: 20799875]     (CVE-2014-8159) (CVE-2014-8159)

The remote OracleVM system is missing necessary patches to address critical security updates :

  - force the fifo access to be in bounds of the allocated     buffer This is XSA-133. [bug 21078975] (CVE-2015-3456)

The remote OracleVM system is missing necessary patches to address critical security updates :

  - force the fifo access to be in bounds of the allocated     buffer This is CVE-2015-3456. [bug 21078935]     (CVE-2015-3456)

  - xen: limit guest control of PCI command register     Otherwise the guest can abuse that control to cause e.g.
    PCIe Unsupported Request responses (by disabling memory     and/or I/O decoding and subsequently causing [CPU side]     accesses to the respective address ranges), which     (depending on system configuration) may be fatal to the     host. This is CVE-2015-2756 / XSA-126.

    Conflicts: tools/ioemu-remote/hw/pass-through.c     (CVE-2015-2756)

  - Limit XEN_DOMCTL_memory_mapping hypercall to only     process up to 64 GFNs (or less) Said hypercall for large     BARs can take quite a while. As such we can require that     the hypercall MUST break up the request in smaller     values. Another approach is to add preemption to it -     whether we do the preemption using     hypercall_create_continuation or returning EAGAIN to     userspace (and have it re-invocate the call) - either     way the issue we cannot easily solve is that in     'map_mmio_regions' if we encounter an error we MUST call     'unmap_mmio_regions' for the whole BAR region. Since the     preemption would re-use input fields such as nr_mfns,     first_gfn, first_mfn - we would lose the original values
    - and only undo what was done in the current round (i.e.
    ignoring anything that was done prior to earlier     preemptions). Unless we re-used the return value as     'EAGAIN|nr_mfns_done<<10' but that puts a limit (since     the return value is a long) on the amount of nr_mfns     that can provided. This patch sidesteps this problem by :

  - Setting an hard limit of nr_mfns having to be 64 or     less.

  - Toolstack adjusts correspondingly to the nr_mfn limit.

  - If the there is an error when adding the toolstack will     call the remove operation to remove the whole region.
    The need to break this hypercall down is for large BARs     can take more than the guest (initial domain usually)     time-slice. This has the negative result in that the     guest is locked out for a long duration and is unable to     act on any pending events. We also augment the code to     return zero if nr_mfns instead of trying to the     hypercall. Suggested-by: Jan Beulich 

    This is CVE-2015-2752 / XSA-125. Conflicts:
    xen/arch/x86/domctl.c (CVE-2015-2752)

The remote OracleVM system is missing necessary patches to address critical security updates :

  - fdc: force the fifo access to be in bounds of the     allocated buffer During processing of certain commands     such as FD_CMD_READ_ID and     FD_CMD_DRIVE_SPECIFICATION_COMMAND the fifo memory     access could get out of bounds leading to memory     corruption with values coming from the guest. Fix this     by making sure that the index is always bounded by the     allocated memory. This is CVE-2015-3456.

    XSA-133 (CVE-2015-3456)

  - fdc: force the fifo access to be in bounds of the     allocated buffer During processing of certain commands     such as FD_CMD_READ_ID and     FD_CMD_DRIVE_SPECIFICATION_COMMAND the fifo memory     access could get out of bounds leading to memory     corruption with values coming from the guest. Fix this     by making sure that the index is always bounded by the     allocated memory. This is CVE-2015-3456.

    XSA-133 (CVE-2015-3456)

  - domctl: don't allow a toolstack domain to call     domain_pause on itself These DOMCTL subops were     accidentally declared safe for disaggregation in the     wake of XSA-77. This is XSA-127. (CVE-2015-2751)

  - xen: limit guest control of PCI command register     Otherwise the guest can abuse that control to cause e.g.
    PCIe Unsupported Request responses (by disabling memory     and/or I/O decoding and subsequently causing [CPU side]     accesses to the respective address ranges), which     (depending on system configuration) may be fatal to the     host. This is CVE-2015-2756 / XSA-126.

    Conflicts:
    tools/qemu-xen-traditional-dir/hw/pass-through.c     (CVE-2015-2756)

  - xen: limit guest control of PCI command register     Otherwise the guest can abuse that control to cause e.g.
    PCIe Unsupported Request responses (by disabling memory     and/or I/O decoding and subsequently causing [CPU side]     accesses to the respective address ranges), which     (depending on system configuration) may be fatal to the     host. This is CVE-2015-2756 / XSA-126. (CVE-2015-2756)

  - Limit XEN_DOMCTL_memory_mapping hypercall to only     process up to 64 GFNs (or less) Said hypercall for large     BARs can take quite a while. As such we can require that     the hypercall MUST break up the request in smaller     values. Another approach is to add preemption to it -     whether we do the preemption using     hypercall_create_continuation or returning EAGAIN to     userspace (and have it re-invocate the call) - either     way the issue we cannot easily solve is that in     'map_mmio_regions' if we encounter an error we MUST call     'unmap_mmio_regions' for the whole BAR region. Since the     preemption would re-use input fields such as nr_mfns,     first_gfn, first_mfn - we would lose the original values
    - and only undo what was done in the current round (i.e.
    ignoring anything that was done prior to earlier     preemptions). Unless we re-used the return value as     'EAGAIN|nr_mfns_done<<10' but that puts a limit (since     the return value is a long) on the amount of nr_mfns     that can provided. This patch sidesteps this problem by :

  - Setting an hard limit of nr_mfns having to be 64 or     less.

  - Toolstack adjusts correspondingly to the nr_mfn limit.

  - If the there is an error when adding the toolstack will     call the remove operation to remove the whole region.
    The need to break this hypercall down is for large BARs     can take more than the guest (initial domain usually)     time-slice. This has the negative result in that the     guest is locked out for a long duration and is unable to     act on any pending events. We also augment the code to     return zero if nr_mfns instead of trying to the     hypercall. Suggested-by: Jan Beulich 

    This is CVE-2015-2752 / XSA-125. (CVE-2015-2752)

The remote OracleVM system is missing necessary patches to address critical security updates :

  - isofs: Fix unchecked printing of ER records (Jan Kara)     [Orabug: 20930551] (CVE-2014-9584)

  - KEYS: close race between key lookup and freeing (Sasha     Levin) [Orabug: 20930548] (CVE-2014-9529)     (CVE-2014-9529)

  - mm: memcg: do not allow task about to OOM kill to bypass     the limit (Johannes Weiner) [Orabug: 20930539]     (CVE-2014-8171)

  - mm: memcg: do not declare OOM from __GFP_NOFAIL     allocations (Johannes Weiner) [Orabug: 20930539]     (CVE-2014-8171)

  - fs: buffer: move allocation failure loop into the     allocator (Johannes Weiner) [Orabug: 20930539]     (CVE-2014-8171)

  - mm: memcg: handle non-error OOM situations more     gracefully (Johannes Weiner) [Orabug: 20930539]     (CVE-2014-8171)

  - mm: memcg: do not trap chargers with full callstack on     OOM (Johannes Weiner) [Orabug: 20930539] (CVE-2014-8171)

  - mm: memcg: rework and document OOM waiting and wakeup     (Johannes Weiner) [Orabug: 20930539] (CVE-2014-8171)

  - mm: memcg: enable memcg OOM killer only for user faults     (Johannes Weiner) [Orabug: 20930539] (CVE-2014-8171)

  - x86: finish user fault error path with fatal signal     (Johannes Weiner) [Orabug: 20930539] (CVE-2014-8171)

  - arch: mm: pass userspace fault flag to generic fault     handler (Johannes Weiner) [Orabug: 20930539]     (CVE-2014-8171)

  - selinux: Permit bounded transitions under NO_NEW_PRIVS     or NOSUID. (Stephen Smalley) [Orabug: 20930501]     (CVE-2014-3215)

The remote OracleVM system is missing necessary patches to address critical security updates :

  - Fix invalid file descriptor reuse while sending DNS     query (#1207995, CVE-2013-7423).

  - Fix buffer overflow in gethostbyname_r with misaligned     buffer (#1209375, CVE-2015-1781).

  - Enhance nscd to detect any configuration file changes     (#1194149).

The remote OracleVM system is missing necessary patches to address critical security updates :

  - fix for CVE-2014-5355 (#1193939) 'krb5: unauthenticated     denial of service in recvauth_common and others'

  - fix for CVE-2014-5353 (#1174543) 'Fix LDAP misused     policy name crash'

  - Changelog fixes to make errata subsystem happy.

  - fix for CVE-2014-5352 (#1179856)     'gss_process_context_token incorrectly frees context     (MITKRB5-SA-2015-001)'

  - fix for CVE-2014-9421 (#1179857) 'kadmind doubly frees     partial deserialization results (MITKRB5-SA-2015-001)'

  - fix for CVE-2014-9422 (#1179861) 'kadmind incorrectly     validates server principal name (MITKRB5-SA-2015-001)'

The remote OracleVM system is missing necessary patches to address critical security updates : please see Oracle VM Security Advisory OVMSA-2015-0040 for details.

The remote OracleVM system is missing necessary patches to address critical security updates :

  - update fix for CVE-2015-0287 to what was released     upstream

  - fix CVE-2015-0209 - potential use after free in     d2i_ECPrivateKey

  - fix CVE-2015-0286 - improper handling of ASN.1 boolean     comparison

  - fix CVE-2015-0287 - ASN.1 structure reuse decoding     memory corruption

  - fix CVE-2015-0289 - NULL dereference decoding invalid     PKCS#7 data

  - fix CVE-2015-0292 - integer underflow in base64 decoder

  - fix CVE-2015-0293 - triggerable assert in SSLv2 server

The remote OracleVM system is missing necessary patches to address critical security updates :

  - Fix CVE-2014-9636 CVE-2014-8139 CVE-2014-8140     (CVE-2014-8141) Resolves: #1196132 #1196120 #1196124     #1196128

The remote OracleVM system is missing necessary patches to address critical security updates :

  - Fixes (CVE-2014-9657)

  - Check minimum size of `record_size'.

  - Fixes (CVE-2014-9658)

  - Use correct value for minimum table length test.

  - Fixes (CVE-2014-9675)

  - New macro that checks one character more than `strncmp'.

  - Fixes (CVE-2014-9660)

  - Check `_BDF_GLYPH_BITS'.

  - Fixes (CVE-2014-9661)

  - Initialize `face->ttf_size'.

  - Always set `face->ttf_size' directly.

  - Exclusively use the `truetype' font driver for loading     the font contained in the `sfnts' array.

  - Fixes (CVE-2014-9663)

  - Fix order of validity tests.

  - Fixes (CVE-2014-9664)

  - Add another boundary testing.

  - Fix boundary testing.

  - Fixes (CVE-2014-9667)

  - Protect against addition overflow.

  - Fixes (CVE-2014-9669)

  - Protect against overflow in additions and     multiplications.

  - Fixes (CVE-2014-9670)

  - Add sanity checks for row and column values.

  - Fixes (CVE-2014-9671)

  - Check `size' and `offset' values.

  - Fixes (CVE-2014-9673)

  - Fix integer overflow by a broken POST table in     resource-fork.

  - Fixes (CVE-2014-9674)

  - Fix integer overflow by a broken POST table in     resource-fork.

  - Additional overflow check in the summation of POST     fragment lengths.

  - Work around behaviour of X11's `pcfWriteFont' and     `pcfReadFont' functions

  - Resolves: #1197737

  - Fix (CVE-2012-5669) (Use correct array size for checking     `glyph_enc')

  - Resolves: #903543

The remote OracleVM system is missing necessary patches to address critical security updates :

  - Fix (CVE-2015-1349)

The remote OracleVM system is missing necessary patches to address critical security updates :

  - kvm: fix excessive pages un-pinning in kvm_iommu_map     error path. (Quentin Casasnovas) [Orabug: 20687313]     (CVE-2014-3601) (CVE-2014-8369) (CVE-2014-3601)

  - ttusb-dec: buffer overflow in ioctl (Dan Carpenter)     [Orabug: 20673376] (CVE-2014-8884)

  - mm: Fix NULL pointer dereference in     madvise(MADV_WILLNEED) support (Kirill A. Shutemov)     [Orabug: 20673281] (CVE-2014-8173)

  - netfilter: conntrack: disable generic tracking for known     protocols (Florian Westphal) [Orabug: 20673239]     (CVE-2014-8160)

  - tracing/syscalls: Ignore numbers outside NR_syscalls'     range (Rabin Vincent) [Orabug: 20673163] (CVE-2014-7826)

  - uek-rpm: ol7: update update-el to 7.1 (Guangyu Sun)     [Orabug: 20524579]

The remote OracleVM system is missing necessary patches to address critical security updates :

  - Backport openssl 08-Jan-2015 security fixes (John Haxby)     [orabug 20409893]

  - fix CVE-2014-3570 - Bignum squaring may produce     incorrect results

  - fix CVE-2014-3571 - DTLS segmentation fault in     dtls1_get_record

  - fix CVE-2014-3572 - ECDHE silently downgrades to ECDH     [Client]

  - fix CVE-2014-8275 - Certificate fingerprints can be     modified

  - fix CVE-2015-0204 - RSA silently downgrades to     EXPORT_RSA [Client]

  - properly lock X509_STORE accesses (#1168938)

The remote OracleVM system is missing necessary patches to address critical security updates :

  - x86emul: fully ignore segment override for register-only     operations (Jan Beulich) (CVE-2015-2151) This is XSA-123

The remote OracleVM system is missing necessary patches to address critical security updates :

  - x86emul: fully ignore segment override for register-only     operations For ModRM encoded instructions with register     operands we must not overwrite ea.mem.seg (if a - bogus     in that case - segment override was present) as it     aliases with ea.reg. This is CVE-2015-2151 / XSA-123.
    (CVE-2015-2151)

The remote OracleVM system is missing necessary patches to address critical security updates : please see Oracle VM Security Advisory OVMSA-2015-0028 for details.

The remote OracleVM system is missing necessary patches to address critical security updates :

  - XSA-122: pre-fill structures for certain     HYPERVISOR_xen_version sub-ops (Jan Beulich) [20588670]     [CVE-2015-2045]

  - XSA-121: return all ones on wrong-sized reads of system     device I/O ports (Jan Beulich) [20588358]     [CVE-2015-2044]

The remote OracleVM system is missing necessary patches to address critical security updates :

  - pre-fill structures for certain HYPERVISOR_xen_version     sub-ops ... avoiding to pass hypervisor stack contents     back to the caller through space unused by the     respective strings. This is XSA-122. (CVE-2015-2045)

  - x86/HVM: return all ones on wrong-sized reads of system     device I/O ports So far the value presented to the guest     remained uninitialized. This is XSA-121. (CVE-2015-2044)

The remote OracleVM system is missing necessary patches to address critical security updates :

  - Switch to use malloc when the input line is too long     [Orabug 19951108]

  - Use a /sys/devices/system/cpu/online for
    _SC_NPROCESSORS_ONLN implementation [Orabug 17642251]     (Joe Jin)

  - Fix parsing of numeric hosts in gethostbyname_r     (CVE-2015-0235, #1183532).

  - Remove gconv transliteration loadable modules support     (CVE-2014-5119, - _nl_find_locale: Improve handling of     crafted locale names (CVE-2014-0475, 

  - Fix patch for integer overflows in *valloc and memalign.
    (CVE-2013-4332, #1011805).

  - Fix return code when starting an already started nscd     daemon (#979413).

  - Fix getnameinfo for many PTR record queries (#1020486).

  - Return EINVAL error for negative sizees to getgroups     (#995207).

  - Fix integer overflows in *valloc and memalign.
    (CVE-2013-4332, #1011805).

  - Add support for newer L3 caches on x86-64 and correctly     count the number of hardware threads sharing a cacheline     (#1003420).

  - Revert incomplete fix for bug #758193.

  - Fix _nl_find_msg malloc failure case, and callers     (#957089).

  - Test on init_fct, not result->__init_fct, after     demangling (#816647).

  - Don't handle ttl == 0 specially (#929035).

  - Fix multibyte character processing crash in regexp     (CVE-2013-0242, #951132)

  - Fix getaddrinfo stack overflow resulting in application     crash (CVE-2013-1914, #951132)

  - Add missing patch to avoid use after free (#816647)

  - Fix race in initgroups compat_call (#706571)

  - Fix return value from getaddrinfo when servers are down.
    (#758193)

  - Fix fseek on wide character streams. Sync's seeking code     with RHEL 6 (#835828)

  - Call feraiseexcept only if exceptions are not masked     (#861871).

  - Always demangle function before checking for NULL value.
    (#816647).

  - Do not fail in ttyname if /proc is not available     (#851450).

  - Fix errno for various overflow situations in vfprintf.
    Add missing overflow checks. (#857387)

  - Handle failure of _nl_explode_name in all cases     (#848481)

  - Define the default fuzz factor to 2 to make it easier to     manipulate RHEL 5 RPMs on RHEL 6 and newer systems.

  - Fix race in intl/* testsuite (#849202)

  - Fix out of bounds array access in strto* exposed by     847930 patch.

  - Really fix POWER4 strncmp crash (#766832).

  - Fix integer overflow leading to buffer overflow in     strto* (#847930)

  - Fix race in msort/qsort (#843672)

  - Fix regression due to 797096 changes (#845952)

  - Do not use PT_IEEE_IP ptrace calls (#839572)

  - Update ULPs (#837852)

  - Fix various transcendentals in non-default rounding     modes (#837852)

  - Fix unbound alloca in vfprintf (#826947)

  - Fix iconv segfault if the invalid multibyte character     0xffff is input when converting from IBM930. (#823905)

  - Fix fnmatch when '*' wildcard is applied on a file name     containing multibyte chars. (#819430)

  - Fix unbound allocas use in glob_in_dir, getaddrinfo and     others. (#797096)

  - Fix segfault when running ld.so --verify on some DSO's     in current working directory. (#808342)

  - Incorrect initialization order for dynamic loader     (#813348)

  - Fix return code when stopping already stopped nscd     daemon (#678227)

  - Remove MAP_32BIT for pthread stack mappings, use     MAP_STACK instead (#641094)

  - Fix setuid vs sighandler_setxid race (#769852)

  - Fix access after end of search string in regex matcher     (#757887)

  - Fix POWER4 strncmp crash (#766832)

  - Fix SC_*CACHE detection for X5670 cpus (#692182)

  - Fix parsing IPV6 entries in /etc/resolv.conf (#703239)

  - Fix double-free in nss_nis code (#500767)

  - Add kernel VDSO support for s390x (#795896)

  - Fix race in malloc arena creation and make     implementation match documented behaviour (#800240)

  - Do not override TTL of CNAME with TTL of its alias     (#808014)

  - Fix short month names in fi_FI locale #(657266).

  - Fix nscd crash for group with large number of members     (#788989)

  - Fix Slovakia currency (#799853)

  - Fix getent malloc failure check (#806403)

  - Fix short month names in zh_CN locale (#657588)

  - Fix decimal point symbol for Portuguese currency     (#710216)

  - Avoid integer overflow in sbrk (#767358)

  - Avoid race between [,__de]allocate_stack and
    __reclaim_stacks during fork (#738665)

  - Fix race between IO_flush_all_lockp & pthread_cancel     (#751748)

  - Fix memory leak in NIS endgrent (#809325)

  - Allow getaddr to accept SCTP socket types in hints     (#765710)

  - Fix errno handling in vfprintf (#794814)

  - Filter out <built-in> when building file lists     (#784646).

  - Avoid 'nargs' integer overflow which could be used to     bypass FORTIFY_SOURCE (#794814)

  - Fix currency_symbol for uk_UA (#639000)

The remote OracleVM system is missing necessary patches to address critical security updates :

  - Switch to use malloc when the input line is too long     [Orabug 19951108]

  - Use a /sys/devices/system/cpu/online for
    _SC_NPROCESSORS_ONLN implementation [Orabug 17642251]     (Joe Jin)

  - Fix parsing of numeric hosts in gethostbyname_r     (CVE-2015-0235, #1183532).

  - Remove gconv transliteration loadable modules support     (CVE-2014-5119, - _nl_find_locale: Improve handling of     crafted locale names (CVE-2014-0475, 

  - Fix patch for integer overflows in *valloc and memalign.
    (CVE-2013-4332, #1011805).

  - Fix return code when starting an already started nscd     daemon (#979413).

  - Fix getnameinfo for many PTR record queries (#1020486).

  - Return EINVAL error for negative sizees to getgroups     (#995207).

  - Fix integer overflows in *valloc and memalign.
    (CVE-2013-4332, #1011805).

  - Add support for newer L3 caches on x86-64 and correctly     count the number of hardware threads sharing a cacheline     (#1003420).

  - Revert incomplete fix for bug #758193.

  - Fix _nl_find_msg malloc failure case, and callers     (#957089).

  - Test on init_fct, not result->__init_fct, after     demangling (#816647).

  - Don't handle ttl == 0 specially (#929035).

  - Fix multibyte character processing crash in regexp     (CVE-2013-0242, #951132)

  - Fix getaddrinfo stack overflow resulting in application     crash (CVE-2013-1914, #951132)

  - Add missing patch to avoid use after free (#816647)

  - Fix race in initgroups compat_call (#706571)

  - Fix return value from getaddrinfo when servers are down.
    (#758193)

  - Fix fseek on wide character streams. Sync's seeking code     with RHEL 6 (#835828)

  - Call feraiseexcept only if exceptions are not masked     (#861871).

  - Always demangle function before checking for NULL value.
    (#816647).

  - Do not fail in ttyname if /proc is not available     (#851450).

  - Fix errno for various overflow situations in vfprintf.
    Add missing overflow checks. (#857387)

  - Handle failure of _nl_explode_name in all cases     (#848481)

  - Define the default fuzz factor to 2 to make it easier to     manipulate RHEL 5 RPMs on RHEL 6 and newer systems.

  - Fix race in intl/* testsuite (#849202)

  - Fix out of bounds array access in strto* exposed by     847930 patch.

  - Really fix POWER4 strncmp crash (#766832).

  - Fix integer overflow leading to buffer overflow in     strto* (#847930)

  - Fix race in msort/qsort (#843672)

  - Fix regression due to 797096 changes (#845952)

  - Do not use PT_IEEE_IP ptrace calls (#839572)

  - Update ULPs (#837852)

  - Fix various transcendentals in non-default rounding     modes (#837852)

  - Fix unbound alloca in vfprintf (#826947)

  - Fix iconv segfault if the invalid multibyte character     0xffff is input when converting from IBM930. (#823905)

  - Fix fnmatch when '*' wildcard is applied on a file name     containing multibyte chars. (#819430)

  - Fix unbound allocas use in glob_in_dir, getaddrinfo and     others. (#797096)

  - Fix segfault when running ld.so --verify on some DSO's     in current working directory. (#808342)

  - Incorrect initialization order for dynamic loader     (#813348)

  - Fix return code when stopping already stopped nscd     daemon (#678227)

  - Remove MAP_32BIT for pthread stack mappings, use     MAP_STACK instead (#641094)

  - Fix setuid vs sighandler_setxid race (#769852)

  - Fix access after end of search string in regex matcher     (#757887)

  - Fix POWER4 strncmp crash (#766832)

  - Fix SC_*CACHE detection for X5670 cpus (#692182)

  - Fix parsing IPV6 entries in /etc/resolv.conf (#703239)

  - Fix double-free in nss_nis code (#500767)

  - Add kernel VDSO support for s390x (#795896)

  - Fix race in malloc arena creation and make     implementation match documented behaviour (#800240)

  - Do not override TTL of CNAME with TTL of its alias     (#808014)

  - Fix short month names in fi_FI locale #(657266).

  - Fix nscd crash for group with large number of members     (#788989)

  - Fix Slovakia currency (#799853)

  - Fix getent malloc failure check (#806403)

  - Fix short month names in zh_CN locale (#657588)

  - Fix decimal point symbol for Portuguese currency     (#710216)

  - Avoid integer overflow in sbrk (#767358)

  - Avoid race between [,__de]allocate_stack and
    __reclaim_stacks during fork (#738665)

  - Fix race between IO_flush_all_lockp & pthread_cancel     (#751748)

  - Fix memory leak in NIS endgrent (#809325)

  - Allow getaddr to accept SCTP socket types in hints     (#765710)

  - Fix errno handling in vfprintf (#794814)

  - Filter out <built-in> when building file lists     (#784646).

  - Avoid 'nargs' integer overflow which could be used to     bypass FORTIFY_SOURCE (#794814)

  - Fix currency_symbol for uk_UA (#639000)

  - Correct test for detecting cycle during topo sort     (#729661)

  - Check values from TZ file header (#767688)

  - Complete the numeric settings fix (#675259)

  - Complete the change for error codes from pthread_create     (#707998)

  - Truncate time values in Linux futimes when falling back     to utime (#758252)

  - Update systemtaparches

  - Add rules to build libresolv with SSP flags (#756453)

  - Fix PLT reference

  - Workaround misconfigured system (#702300)

  - Update systemtaparches

  - Correct cycle detection during dependency sorting     (#729661)

  - Add gdb hooks (#711924)

  - Fix alloca accounting in strxfm and strcoll (#585433)

  - Correct cycle detection during dependency sorting     (#729661)

  - ldd: never run file directly (#531160)

  - Implement greedy matching of weekday and month names     (#657570)

  - Fix incorrect numeric settings (#675259)

  - Implement new mode for NIS passwd.adjunct.byname table     (#678318)

  - Query NIS domain only when needed (#703345)

  - Count total processors using sysfs (#706894)

  - Translate clone error if necessary (#707998)

  - Workaround kernel clobbering robust list (#711531)

  - Use correct type when casting d_tag (#599056,     CVE-2010-0830)

  - Report write error in addmnt even for cached streams     (#688980, CVE-2011-1089)

  - Don't underestimate length of DST substitution (#694655)

  - Don't allocate executable stack when it cannot be     allocated in the first 4G (#448011)

  - Initialize resolver state in nscd (#676039)

  - No cancel signal in unsafe places (#684808)

  - Check size of pattern in wide character representation     in fnmatch (#681054)

  - Avoid too much stack use in fnmatch (#681054,     CVE-2011-1071)

  - Properly quote output of locale (#625893, CVE-2011-1095)

  - Don't leave empty element in rpath when skipping the     first element, ignore rpath elements containing     non-isolated use of $ORIGIN when privileged (#667974,     CVE-2011-0536)

  - Fix handling of newline in addmntent (#559579,     CVE-2010-0296)

  - Don't ignore $ORIGIN in libraries (#670988)

  - Fix false assertion (#604796)

  - Fix ordering of DSO constructors and destructors     (#604796)

  - Fix typo (#531576)

  - Fix concurrency problem between dl_open and     dl_iterate_phdr (#649956)

  - Require suid bit on audit objects in privileged programs     (#645678, CVE-2010-3856)

  - Never expand $ORIGIN in privileged programs (#643819,     CVE-2010-3847)

  - Add timestamps to nscd logs (#527558)

  - Fix index wraparound handling in memusage (#531576)

  - Handle running out of buffer space with IPv6 mapping     enabled (#533367)

  - Don't deadlock in __dl_iterate_phdr while (un)loading     objects (#549813)

  - Avoid alloca in setenv for long strings (#559974)

  - Recognize POWER7 and ISA 2.06 (#563563)

  - Add support for AT_BASE_PLATFORM (#563599)

  - Restore locking in free_check (#585674)

  - Fix lookup of collation sequence value during regexp     matching (#587360)

  - Fix POWER6 memcpy/memset (#579011)

  - Fix scope handling during dl_close (#593675)

  - Enable -fasynchronous-unwind-tables throughout (#593047)

  - Fix crash when aio thread creation fails (#566712)

The remote OracleVM system is missing necessary patches to address critical security updates :

  - Fix parsing of numeric hosts in gethostbyname_r     (CVE-2015-0235, #1183533).

The remote OracleVM system is missing necessary patches to address critical security updates :

  - CVE-2014-8157 - dec->numtiles off-by-one check in     jpc_dec_process_sot (#1183671)

  - CVE-2014-8158 - unrestricted stack memory use in     jpc_qmfb.c (#1183679)

  - CVE-2014-8137 - double-free in in jas_iccattrval_destroy     (#1173566)

  - CVE-2014-8138 - heap overflow in jp2_decode (#1173566)

  - CVE-2014-9029 - incorrect component number check in COC,     RGN and QCC marker segment decoders (#1171208)

The remote OracleVM system is missing necessary patches to address critical security updates :

  - fix CVE-2014-3570 - incorrect computation in BN_sqr

  - fix CVE-2014-3571 - possible crash in dtls1_get_record

  - fix CVE-2014-3572 - possible downgrade of ECDH     ciphersuite to non-PFS state

  - fix CVE-2014-8275 - various certificate fingerprint     issues

  - fix CVE-2015-0204 - remove support for RSA ephemeral     keys for non-export ciphersuites and on server

  - fix CVE-2015-0205 - do not allow unauthenticated client     DH certificate

  - fix CVE-2015-0206 - possible memory leak when buffering     DTLS records

  - use FIPS approved method for computation of d in RSA

The remote OracleVM system is missing necessary patches to address critical security updates : please see Oracle VM Security Advisory OVMSA-2015-0004 for details.

The remote OracleVM system is missing necessary patches to address critical security updates :

  - Fix recursive dlopen (#1173469).

  - Fix typo in res_send and res_query (#rh1172023).

  - Fix crashes on invalid input in IBM gconv modules     (CVE-2014-6040, #1139571).

  - Fix wordexp to honour WRDE_NOCMD (CVE-2014-7817,     #1170121).

The remote OracleVM system is missing necessary patches to address critical security updates :

  - don't generate weak control key for resolver     (CVE-2014-9293)

  - don't generate weak MD5 keys in ntp-keygen     (CVE-2014-9294)

  - fix buffer overflows via specially-crafted packets     (CVE-2014-9295)

  - increase memlock limit again (#1035198)

  - allow selection of cipher for private key files     (#741573)

  - revert init script priority (#470945, #689636)

  - drop tentative patch (#489835)

  - move restorecon call to %posttrans

  - call restorecon on ntpd and ntpdate on start (#470945)

  - don't crash with more than 512 local addresses (#661934)

  - add -I option (#528799)

  - fix -L option to not require argument (#460434)

  - move ntpd and ntpdate to /sbin and start earlier on boot     (#470945, #689636)

  - increase memlock limit (#575874)

  - ignore tentative addresses (#489835)

  - print synchronization distance instead of dispersion in     ntpstat (#679034)

  - fix typos in ntpq and ntp-keygen man pages (#664524,     #664525)

  - clarify ntpd -q description (#591838)

  - don't verify ntp.conf (#481151)

  - replace Prereq tag

  - fix DoS with mode 7 packets (#532640, CVE-2009-3563)

  - compile with -fno-strict-aliasing

  - fix buffer overflow when parsing Autokey association     message (#500784, CVE-2009-1252)

  - fix buffer overflow in ntpq (#500784, CVE-2009-0159)

  - fix check for malformed signatures (#479699,     CVE-2009-0021)

The remote OracleVM system is missing necessary patches to address critical security updates :

  - Remove default ntp servers in ntp.conf [bug 14342986]

  - don't generate weak control key for resolver     (CVE-2014-9293)

  - don't generate weak MD5 keys in ntp-keygen     (CVE-2014-9294)

  - fix buffer overflows via specially-crafted packets     (CVE-2014-9295)

  - increase memlock limit again (#1035198)

  - allow selection of cipher for private key files     (#741573)

  - revert init script priority (#470945, #689636)

  - drop tentative patch (#489835)

  - move restorecon call to %posttrans

  - call restorecon on ntpd and ntpdate on start (#470945)

  - don't crash with more than 512 local addresses (#661934)

  - add -I option (#528799)

  - fix -L option to not require argument (#460434)

  - move ntpd and ntpdate to /sbin and start earlier on boot     (#470945, #689636)

  - increase memlock limit (#575874)

  - ignore tentative addresses (#489835)

  - print synchronization distance instead of dispersion in     ntpstat (#679034)

  - fix typos in ntpq and ntp-keygen man pages (#664524,     #664525)

  - clarify ntpd -q description (#591838)

  - don't verify ntp.conf (#481151)

  - replace Prereq tag

  - fix DoS with mode 7 packets (#532640, CVE-2009-3563)

  - compile with -fno-strict-aliasing

  - fix buffer overflow when parsing Autokey association     message (#500784, CVE-2009-1252)

  - fix buffer overflow in ntpq (#500784, CVE-2009-0159)

  - fix check for malformed signatures (#479699,     CVE-2009-0021)

The remote OracleVM system is missing necessary patches to address critical security updates :

  - CVE-2014-8137 - double-free in in jas_iccattrval_destroy     (#1173566)

  - CVE-2014-8138 - heap overflow in jp2_decode (#1173566)

The remote OracleVM system is missing necessary patches to address critical security updates :

  - CVE-2004-2771 mailx: command execution flaw resolves:
    #1171175

  - resolves: #857120 fixed incorrect return code when     TMPDIR points to invalid path

  - resolves: #845098 added support for alternatives

The remote OracleVM system is missing necessary patches to address critical security updates :

  - don't generate weak control key for resolver     (CVE-2014-9293)

  - don't generate weak MD5 keys in ntp-keygen     (CVE-2014-9294)

  - fix buffer overflows via specially-crafted packets     (CVE-2014-9295)

  - don't mobilize passive association when authentication     fails (CVE-2014-9296)

The remote OracleVM system is missing necessary patches to address critical security updates :

  - Fix CVE-2014-8500 (#1171973)

  - Use /dev/urandom when generating rndc.key file (#951255)

  - Remove bogus file from /usr/share/doc, introduced by fix     for bug #1092035

  - Add support for TLSA resource records (#956685)

  - Increase defaults for lwresd workers and make workers     and client objects number configurable (#1092035)

  - Fix segmentation fault in nsupdate when -r option is     used (#1064045)

  - Fix race condition on send buffer in host tool when     sending UDP query (#1008827)

  - Allow authentication using TSIG in allow-notify     configuration statement (#1044545)

  - Fix SELinux context of /var/named/chroot/etc/localtime     (#902431)

  - Include updated named.ca file with root server addresses     (#917356)

  - Don't generate rndc.key if there is rndc.conf on     start-up (#997743)

  - Fix dig man page regarding how to disable IDN (#1023045)

  - Handle ICMP Destination unreachable (Protocol     unreachable) response (#1066876)

  - Configure BIND with --with-dlopen=yes to support     dynamically loadable DLZ drivers (#846065)

  - Fix initscript to return correct exit value when calling     checkconfig/configtest/check/test (#848033)

  - Don't (un)mount chroot filesystem when running     initscript command configtest with running server     (#851123)

  - Fix zone2sqlite tool to accept zones containing '.' or     '-' or starting with a digit (#919414)

  - Fix initscript not to mount chroot filesystem is named     is already running (#948743)

  - Fix initscript to check if the PID in PID-file is really     s PID of running named server (#980632)

  - Correct the installed documentation ownership (#1051283)

  - configure with --enable-filter-aaaa to enable use of     filter-aaaa-on-v4 option (#1025008)

  - Fix race condition when destroying a resolver fetch     object (#993612)

  - Fix the RRL functionality to include     referrals-per-second and nodata-per-second options     (#1036700)

  - Fix segfault on SERVFAIL to NXDOMAIN failover (#919545)

  - Fix (CVE-2014-0591)

  - Fix gssapictx memory leak (#911167)

  - fix (CVE-2013-4854)

  - fix (CVE-2013-2266)

  - ship dns/rrl.h in -devel subpkg

  - remove one bogus file from /usr/share/doc, introduced by     RRL patch

  - fix (CVE-2012-5689)

  - add response rate limit patch (#873624)

The remote OracleVM system is missing necessary patches to address critical security updates :

  - Fix race condidition where unchecked data is exposed in     the file system (CVE-2013-6435)(#1163059)

  - Fix thinko in the non-root python byte-compilation fix

  - Byte-compile versioned python libdirs in non-root prefix     too (#868332)

  - Fix segfault on rpmdb addition when header unload fails     (#706935)

  - Add a compat mode for enabling legacy rpm scriptlet     error behavior (#963724)

  - Fix build-time double-free on file capability processing     (#904818)

  - Fix include-directive getting processed on false branch     (#920190)

  - Bring back --fileid in the man page with description of     the id (#804049)

  - Fix missing error on --import on bogus key file     (#869667)

  - Add DWARF 4 support to debugedit (#858731)

  - Add better error handling to patch for bug

  - Fix memory corruption on multikey PGP packets/armors     (#829621)

  - Handle identical binaries for debug-info (#727872)

  - Fix typos in Japanese rpm man page (#845065)

  - Document -D and -E options in man page (#845063)

  - Add --setperms and --setuids to the man page (#839126)

  - Update man page that SHA256 is also used for file digest     (#804049)

  - Remove --fileid from man page to get rid of md5

  - Remove -s from patch calls (#773503)

  - Force _host_vendor to redhat to better match toolchain     (#743229)

  - Backport reloadConfig for Python API (#825147)

  - Support for dpkg-style sorting of tilde in     version/release (#825087)

  - Fix explicit directory %attr when %defattr is active     (#730473)

  - Don't load keyring if signature checking is disabled     (#664696)

  - Retry read to fix rpm2cpio with pipe as stdin (#802839)

The remote OracleVM system is missing necessary patches to address critical security updates :

nss

  - Added nss-vendor.patch to change vendor

  - Resolves: Bug 1158160 - Upgrade to NSS 3.16.2.3 for     Firefox 31.3

  - Remove unused indentation pseudo patch

  - require nss util 3.16.2.3

  - Restore patch for certutil man page

  - supply missing options descriptions to the man page

  - Resolves: Bug 1158160 - Upgrade to NSS 3.16.2.3 for     Firefox 31.3

  - Resolves: Bug 1165003 - Upgrade to NSS 3.16.2.3 for     Firefox 31.3

  - Support TLS_FALLBACK_SCSV in tstclnt and ssltap

  - Resolves: Bug 1145432 - (CVE-2014-1568)

  - Fix pem deadlock caused by previous version of a fix for     a race condition

  - Fixes: Bug 1090681

  - Add references to bugs filed upstream

  - Related: Bug 1090681, Bug 1104300

  - Resolves: Bug 1090681 - RHDS 9.1     389-ds-base-1.2.11.15-31 crash in PK11_DoesMechanism

  - Replace expired PayPal test certificate that breaks the     build

  - Related: Bug 1099619

  - Fix defects found by coverity

  - Resolves: Bug 1104300

  - Backport nss-3.12.6 upstream fix required by Firefox 31

  - Resolves: Bug 1099619

nss-util

  - Resolves: Bug 1165003 - Upgrade to NSS 3.16.2.3 for     Firefox 31.3

  - Fix the required nspr version to be 4.10.6

The remote OracleVM system is missing necessary patches to address critical security updates :

  - CVE-2014-0209: integer overflow of allocations in font     metadata file parsing (bug 1163602, bug 1163601)

  - CVE-2014-0210: unvalidated length fields when parsing     xfs protocol replies (bug 1163602, bug 1163601)

  - CVE-2014-0211: integer overflows calculating memory     needs for xfs replies (bug 1163602, bug 1163601)

  - CVE-2013-6462.patch: sscanf overflow (bug 1049684)

  - sscanf-hardening.patch: Some other sscanf hardening     fixes (1049684)

The remote OracleVM system is missing necessary patches to address critical security updates :

  - xend: disable sslv3 due to (CVE-2014-3566)

  - Keep the maxmem and memory same in vm.cfg Singed-off-by:
    Annie Li

The remote OracleVM system is missing necessary patches to address critical security updates :

  - add support for fallback SCSV to partially mitigate     (CVE-2014-3566) (padding attack on SSL3)

  - fix CVE-2014-0221 - recursion in DTLS code leading to     DoS

  - fix CVE-2014-3505 - doublefree in DTLS packet processing

  - fix CVE-2014-3506 - avoid memory exhaustion in DTLS

  - fix CVE-2014-3508 - fix OID handling to avoid     information leak

  - fix CVE-2014-3510 - fix DoS in anonymous (EC)DH handling     in DTLS

  - fix for CVE-2014-0224 - SSL/TLS MITM vulnerability

  - replace expired GlobalSign Root CA certificate in     ca-bundle.crt

The remote OracleVM system is missing necessary patches to address critical security updates :

  - xend: disable sslv3 due to (CVE-2014-3566)

The remote OracleVM system is missing necessary patches to address critical security updates :

  - disable sslv3 due to (CVE-2014-3566)

  - Allow to create more than 6 bonds Singed-off-by: Adnan     Misherfi

The remote OracleVM system is missing necessary patches to address critical security updates :

  - Fix CVE-2014-4877 wget: FTP symlink arbitrary filesystem     access (#1156133)

  - Fix the parsing of weblink when doing recursive     retrieving (#960137)

  - Fix errors found by static analysis of source code     (#873216)

  - Add SNI (Server Name Indication) support (#909604)

  - Add --trust-server-names option to fix CVE-2010-2252     (#1062190)

  - Fix wget to recognize certificates with alternative     names (#736445)

The remote OracleVM system is missing necessary patches to address critical security updates :

  - Revert change to whitelist /rss/ resources, as this was     not used upstream.

  - More STR #4461 fixes from upstream: make rss feeds     world-readable, but cachedir private.

  - Fix icon display in web interface during server restart     (STR #4475).

  - Fixes for upstream patch for STR #4461: allow /rss/     requests for files we created.

  - Use upstream patch for STR #4461.

  - Applied upstream patch to fix CVE-2014-5029 (bug     #1122600), CVE-2014-5030 (bug #1128764), CVE-2014-5031     (bug #1128767).

  - Fix conf/log file reading for authenticated users (STR     #4461).

  - Fix CGI handling (STR #4454, bug #1120419).

  - fix patch for CVE-2014-3537 (bug #1117794)

  - CVE-2014-2856: cross-site scripting flaw (bug #1117798)

  - CVE-2014-3537: insufficient checking leads to privilege     escalation (bug #1117794)

  - Removed package description changes.

  - Applied patch to fix 'Bad request' errors as a result of     adding in httpSetTimeout (STR #4440, also part of svn     revision 9967).

  - Fixed timeout issue with cupsd reading when there is no     data ready (bug #1110045).

  - Fixed synconclose patch to avoid 'too many arguments for     format' warning.

  - Fixed settimeout patch to include math.h for fmod     declaration.

  - Fixed typo preventing web interface from changing driver     (bug #1104483, STR #3601).

  - Fixed SyncOnClose patch (bug #984883).

  - Use upstream patch to avoid replaying GSS credentials     (bug #1040293).

  - Prevent BrowsePoll problems across suspend/resume (bug     #769292) :

  - Eliminate indefinite wait for response (svn revision     9688).

  - Backported httpSetTimeout API function from CUPS 1.5 and     use it in the ipp backend so that we wait indefinitely     until the printer responds, we get a hard error, or the     job is cancelled.

  - cups-polld: reconnect on error.

  - Added new SyncOnClose directive to use fsync after     altering configuration files: defaults to 'Yes'. Adjust     in cupsd.conf (bug #984883).

  - Fix cupsctl man page typo (bug #1011076).

  - Use more portable rpm specfile syntax for conditional     php building (bug #988598).

  - Fix SetEnv directive in cupsd.conf (bug #986495).

  - Fix 'collection' attribute sending (bug #978387).

  - Prevent format_log segfault (bug #971079).

  - Prevent stringpool corruption (bug #884851).

  - Don't crash when job queued for printer that times out     (bug #855431).

  - Upstream patch for broken multipart handling (bug     #852846).

  - Install /etc/cron.daily/cups with correct permissions     (bug #1012482).

  - Fixes for jobs with multiple files and multiple formats     (bug #972242).

  - Applied patch to fix CVE-2012-5519 (privilege escalation     for users in SystemGroup or with equivalent polkit     permission). This prevents HTTP PUT requests with paths     under /admin/conf/ other than that for cupsd.conf, and     also prevents such requests altering certain     configuration directives such as PageLog and FileDevice     (bug #875898).

The remote OracleVM system is missing necessary patches to address critical security updates :

  - actually apply that last patch

  - incorporate fix for MITKRB5-SA-2014-001 (CVE-2014-4345,     #1128157)

  - ksu: when evaluating .k5users, don't throw away data     from .k5users when we're not passed a command to run,     which implicitly means we're attempting to run the     target user's shell (#1026721, revised)

  - ksu: when evaluating .k5users, treat lines with just a     principal name as if they contained the principal name     followed by '*', and don't throw away data from .k5users     when we're not passed a command to run, which implicitly     means we're attempting to run the target user's shell     (#1026721, revised)

  - gssapi: pull in upstream fix for a possible NULL     dereference in spnego (CVE-2014-4344, #1121510)

  - gssapi: pull in proposed-and-accepted fix for a double     free in initiators (David Woodhouse, CVE-2014-4343,     #1121510)

  - correct a type mistake in the backported fix for     (CVE-2013-1418, CVE-2013-6800)

  - pull in backported fix for denial of service by     injection of malformed GSSAPI tokens (CVE-2014-4341,     CVE-2014-4342, #1121510)

  - incorporate backported patch for remote crash of KDCs     which serve multiple realms simultaneously (RT#7756,     CVE-2013-1418/CVE-2013-6800, more of

  - pull in backport of patch to not subsequently always     require that responses come from master KDCs if we get     one from a master somewhere along the way while chasing     referrals (RT#7650, #1113652)

  - ksu: if the -e flag isn't used, use the target user's     shell when checking for authorization via the target     user's .k5users file (#1026721)

  - define _GNU_SOURCE in files where we use EAI_NODATA, to     make sure that it's declared (#1059730)

  - spnego: pull in patch from master to restore preserving     the OID of the mechanism the initiator requested when we     have multiple OIDs for the same mechanism, so that we     reply using the same mechanism OID and the initiator     doesn't get confused (#1087068, RT#7858)

  - add patch from Jatin Nansi to avoid attempting to clear     memory at the NULL address if krb5_encrypt_helper     returns an error when called from encrypt_credencpart     (#1055329, pull #158)

  - drop patch to add additional access checks to ksu - they     shouldn't be resulting in any benefit

  - apply patch from Nikolai Kondrashov to pass a default     realm set in /etc/sysconfig/krb5kdc to the     kdb_check_weak helper, so that it doesn't produce an     error if there isn't one set in krb5.conf (#1009389)

  - packaging: don't Obsoletes: older versions of     krb5-pkinit-openssl and virtual Provide:
    krb5-pkinit-openssl on EL6, where we don't need to     bother with any of that (#1001961)

  - pkinit: backport tweaks to avoid trying to call the     prompter callback when one isn't set (part of #965721)

  - pkinit: backport the ability to use a prompter callback     to prompt for a password when reading private keys (the     rest of #965721)

  - backport fix to not spin on a short read when reading     the length of a response over TCP (RT#7508, #922884)

  - backport fix for trying all compatible keys when not     being strict about acceptor names while reading AP-REQs     (RT#7883, #1070244)

  - backport fix for not being able to verify the list of     transited realms in GSS acceptors (RT#7639, #959685)

  - pull fix for keeping track of the message type when     parsing FAST requests in the KDC (RT#7605, #951965)

  - incorporate upstream patch to fix a NULL pointer     dereference while processing certain TGS requests     (CVE-2013-1416, #950343)

  - incorporate upstream patch to fix a NULL pointer     dereference when the client supplies an     otherwise-normal-looking PKINIT request (CVE-2013-1415,     #917910)

  - add patch to avoid dereferencing a NULL pointer in the     KDC when handling a draft9 PKINIT request (#917910,     CVE-2012-1016)

  - pull up fix for UDP ping-pong flaw in kpasswd service     (CVE-2002-2443, 

  - don't leak the memory used to hold the previous entry     when walking a keytab to figure out which kinds of keys     we have (#911147)

The remote OracleVM system is missing necessary patches to address critical security updates :

  - Remove gconv transliteration loadable modules support     (CVE-2014-5119, - _nl_find_locale: Improve handling of     crafted locale names (CVE-2014-0475, 

  - Switch gettimeofday from INTUSE to libc_hidden_proto     (#1099025).

  - Fix stack overflow due to large AF_INET6 requests     (CVE-2013-4458, #1111460).

  - Fix buffer overflow in readdir_r (CVE-2013-4237,     #1111460).

  - Fix memory order when reading libgcc handle (#905941).

  - Fix format specifier in malloc_info output (#1027261).

  - Fix nscd lookup for innetgr when netgroup has wildcards     (#1054846).

  - Add mmap usage to malloc_info output (#1027261).

  - Use NSS_STATUS_TRYAGAIN to indicate insufficient buffer     (#1087833).

  - [ppc] Add VDSO IFUNC for gettimeofday (#1028285).

  - [ppc] Fix ftime gettimeofday internal call returning     bogus data (#1099025).

  - Also relocate in dependency order when doing symbol     dependency testing (#1019916).

  - Fix infinite loop in nscd when netgroup is empty     (#1085273).

  - Provide correct buffer length to netgroup queries in     nscd (#1074342).

  - Return NULL for wildcard values in getnetgrent from nscd     (#1085289).

  - Avoid overlapping addresses to stpcpy calls in nscd     (#1082379).

  - Initialize all of datahead structure in nscd (#1074353).

  - Return EAI_AGAIN for AF_UNSPEC when herrno is TRY_AGAIN     (#1044628).

  - Do not fail if one of the two responses to AF_UNSPEC     fails (#845218).

  - nscd: Make SELinux checks dynamic (#1025933).

  - Fix race in free of fastbin chunk (#1027101).

  - Fix copy relocations handling of unique objects     (#1032628).

  - Fix encoding name for IDN in getaddrinfo (#981942).

  - Fix return code from getent netgroup when the netgroup     is not found (#1039988).

  - Fix handling of static TLS in dlopen'ed objects     (#995972).

  - Don't use alloca in addgetnetgrentX (#1043557).

  - Adjust pointers to triplets in netgroup query data     (#1043557).

ID	Name	Severity
84139	OracleVM 3.3 : xen (OVMSA-2015-0067)	high
84004	OracleVM 3.3 : openssl (OVMSA-2015-0065) (Logjam)	low
83967	OracleVM 3.3 : xen (OVMSA-2015-0064)	high
83966	OracleVM 3.2 : xen (OVMSA-2015-0063)	high
83485	OracleVM 3.3 : kernel-uek (OVMSA-2015-0060)	medium
83484	OracleVM 2.2 : xen (OVMSA-2015-0059) (Venom)	high
83483	OracleVM 3.2 : xen (OVMSA-2015-0058) (Venom)	high
83482	OracleVM 3.3 : xen (OVMSA-2015-0057) (Venom)	high
83108	OracleVM 3.3 : kernel-uek (OVMSA-2015-0056)	medium
82983	OracleVM 3.3 : glibc (OVMSA-2015-0055)	medium
82692	OracleVM 3.3 : krb5 (OVMSA-2015-0054)	high
82691	OracleVM 3.3 : kernel-uek (OVMSA-2015-0040)	high
82066	OracleVM 3.3 : openssl (OVMSA-2015-0039)	high
81968	OracleVM 3.3 : unzip (OVMSA-2015-0037)	high
81967	OracleVM 3.3 : freetype (OVMSA-2015-0036)	high
81948	OracleVM 3.3 : bind (OVMSA-2015-0033)	medium
81904	OracleVM 3.3 : kernel-uek (OVMSA-2015-0034)	high
81903	OracleVM 2.2 : openssl (OVMSA-2015-0030) (FREAK)	medium
81874	OracleVM 2.2 : xen (OVMSA-2015-0035)	high
81768	OracleVM 3.2 : xen (OVMSA-2015-0032)	high
81767	OracleVM 3.3 : xen (OVMSA-2015-0031)	high
81726	OracleVM 3.2 : openssl (OVMSA-2015-0029) (FREAK)	medium
81696	OracleVM 3.2 : xen (OVMSA-2015-0028)	medium
81695	OracleVM 2.2 : xen (OVMSA-2015-0027)	low
81694	OracleVM 3.3 : xen (OVMSA-2015-0026)	low
81119	OracleVM 2.2 : glibc (OVMSA-2015-0024) (GHOST)	high
81118	OracleVM 3.2 : glibc (OVMSA-2015-0023) (GHOST)	high
81103	OracleVM 3.3 : glibc (OVMSA-2015-0022) (GHOST)	high
81012	OracleVM 3.3 : jasper (OVMSA-2015-0006)	high
80929	OracleVM 3.3 : openssl (OVMSA-2015-0005) (FREAK)	medium
80928	OracleVM 3.3 : xen (OVMSA-2015-0004)	medium
80439	OracleVM 3.3 : glibc (OVMSA-2015-0003)	medium
80395	OracleVM 2.2 : ntp (OVMSA-2015-0002)	high
80394	OracleVM 3.2 : ntp (OVMSA-2015-0001)	high
80280	OracleVM 3.3 : jasper (OVMSA-2014-0087)	high
80279	OracleVM 3.3 : mailx (OVMSA-2014-0086)	high
80248	OracleVM 3.3 : ntp (OVMSA-2014-0085)	high
80247	OracleVM 3.3 : bind (OVMSA-2014-0084)	high
80008	OracleVM 3.3 : rpm (OVMSA-2014-0083)	high
80007	OracleVM 3.3 : nss (OVMSA-2014-0082)	high
79557	OracleVM 3.3 : libXfont (OVMSA-2014-0080)	high
79556	OracleVM 3.2 : xen (OVMSA-2014-0041) (POODLE)	low
79555	OracleVM 2.2 : openssl (OVMSA-2014-0040) (POODLE)	high
79554	OracleVM 3.2 : openssl (OVMSA-2014-0039) (POODLE)	high
79553	OracleVM 3.3 : xen (OVMSA-2014-0038) (POODLE)	low
79552	OracleVM 3.2 : ovs-agent (OVMSA-2014-0037) (POODLE)	low
79551	OracleVM 3.3 : wget (OVMSA-2014-0036)	high
79550	OracleVM 3.3 : cups (OVMSA-2014-0035)	high
79549	OracleVM 3.3 : krb5 (OVMSA-2014-0034)	high
79548	OracleVM 3.3 : glibc (OVMSA-2014-0033)	high

Detections

Analytics

OracleVM Local Security Checks Family for Nessus

high

low

high

high

medium

high

high

high

medium

medium

high

high

high

high

high

medium

high

medium

high

high

high

medium

medium

low

low

high

high

high

high

medium

medium

medium

high

high

high

high

high

high

high

high

high

low

high

high

low

low

high

high

high

high